[PATCH-for-7.0 0/2] hw/nvme/ctrl: Buffer types cleanups

[PATCH-for-7.0 0/2] hw/nvme/ctrl: Buffer types cleanups

[Philippe Mathieu-Daudé]

Some trivial notes I took while reviewing CVE-2021-3947:
https://lore.kernel.org/qemu-devel/20211111153125.2258176-1-philmd@redhat.com/

Based-on: <20211111153125.2258176-1-philmd@redhat.com>

*** BLURB HERE ***

Philippe Mathieu-Daudé (2):
  hw/nvme/ctrl: Have nvme_addr_write() take const buffer
  hw/nvme/ctrl: Pass buffers as 'void *' types

 hw/nvme/nvme.h |  4 ++--
 hw/nvme/ctrl.c | 12 ++++++------
 2 files changed, 8 insertions(+), 8 deletions(-)

-- 
2.31.1

[PATCH-for-7.0 1/2] hw/nvme/ctrl: Have nvme_addr_write() take const buffer

[Philippe Mathieu-Daudé]

The 'buf' argument is not modified, so better pass it as const type.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
---
 hw/nvme/ctrl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index 634b290e069..c7cce63372a 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -377,7 +377,7 @@ static int nvme_addr_read(NvmeCtrl *n, hwaddr addr, void *buf, int size)
     return pci_dma_read(&n->parent_obj, addr, buf, size);
 }
 
-static int nvme_addr_write(NvmeCtrl *n, hwaddr addr, void *buf, int size)
+static int nvme_addr_write(NvmeCtrl *n, hwaddr addr, const void *buf, int size)
 {
     hwaddr hi = addr + size - 1;
     if (hi < addr) {
-- 
2.31.1

[PATCH-for-7.0 2/2] hw/nvme/ctrl: Pass buffers as 'void *' types

[Philippe Mathieu-Daudé]

These buffers can be anything, not an array of chars,
so use the 'void *' type for them.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
---
 hw/nvme/nvme.h |  4 ++--
 hw/nvme/ctrl.c | 10 +++++-----
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/hw/nvme/nvme.h b/hw/nvme/nvme.h
index 83ffabade4c..38f3ebf7f6c 100644
--- a/hw/nvme/nvme.h
+++ b/hw/nvme/nvme.h
@@ -495,9 +495,9 @@ static inline uint16_t nvme_cid(NvmeRequest *req)
 }
 
 void nvme_attach_ns(NvmeCtrl *n, NvmeNamespace *ns);
-uint16_t nvme_bounce_data(NvmeCtrl *n, uint8_t *ptr, uint32_t len,
+uint16_t nvme_bounce_data(NvmeCtrl *n, void *ptr, uint32_t len,
                           NvmeTxDirection dir, NvmeRequest *req);
-uint16_t nvme_bounce_mdata(NvmeCtrl *n, uint8_t *ptr, uint32_t len,
+uint16_t nvme_bounce_mdata(NvmeCtrl *n, void *ptr, uint32_t len,
                            NvmeTxDirection dir, NvmeRequest *req);
 void nvme_rw_complete_cb(void *opaque, int ret);
 uint16_t nvme_map_dptr(NvmeCtrl *n, NvmeSg *sg, size_t len,
diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index c7cce63372a..8feefde9d19 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -1140,7 +1140,7 @@ static uint16_t nvme_tx_interleaved(NvmeCtrl *n, NvmeSg *sg, uint8_t *ptr,
     return NVME_SUCCESS;
 }
 
-static uint16_t nvme_tx(NvmeCtrl *n, NvmeSg *sg, uint8_t *ptr, uint32_t len,
+static uint16_t nvme_tx(NvmeCtrl *n, NvmeSg *sg, void *ptr, uint32_t len,
                         NvmeTxDirection dir)
 {
     assert(sg->flags & NVME_SG_ALLOC);
@@ -1176,7 +1176,7 @@ static uint16_t nvme_tx(NvmeCtrl *n, NvmeSg *sg, uint8_t *ptr, uint32_t len,
     return NVME_SUCCESS;
 }
 
-static inline uint16_t nvme_c2h(NvmeCtrl *n, uint8_t *ptr, uint32_t len,
+static inline uint16_t nvme_c2h(NvmeCtrl *n, void *ptr, uint32_t len,
                                 NvmeRequest *req)
 {
     uint16_t status;
@@ -1189,7 +1189,7 @@ static inline uint16_t nvme_c2h(NvmeCtrl *n, uint8_t *ptr, uint32_t len,
     return nvme_tx(n, &req->sg, ptr, len, NVME_TX_DIRECTION_FROM_DEVICE);
 }
 
-static inline uint16_t nvme_h2c(NvmeCtrl *n, uint8_t *ptr, uint32_t len,
+static inline uint16_t nvme_h2c(NvmeCtrl *n, void *ptr, uint32_t len,
                                 NvmeRequest *req)
 {
     uint16_t status;
@@ -1202,7 +1202,7 @@ static inline uint16_t nvme_h2c(NvmeCtrl *n, uint8_t *ptr, uint32_t len,
     return nvme_tx(n, &req->sg, ptr, len, NVME_TX_DIRECTION_TO_DEVICE);
 }
 
-uint16_t nvme_bounce_data(NvmeCtrl *n, uint8_t *ptr, uint32_t len,
+uint16_t nvme_bounce_data(NvmeCtrl *n, void *ptr, uint32_t len,
                           NvmeTxDirection dir, NvmeRequest *req)
 {
     NvmeNamespace *ns = req->ns;
@@ -1218,7 +1218,7 @@ uint16_t nvme_bounce_data(NvmeCtrl *n, uint8_t *ptr, uint32_t len,
     return nvme_tx(n, &req->sg, ptr, len, dir);
 }
 
-uint16_t nvme_bounce_mdata(NvmeCtrl *n, uint8_t *ptr, uint32_t len,
+uint16_t nvme_bounce_mdata(NvmeCtrl *n, void *ptr, uint32_t len,
                            NvmeTxDirection dir, NvmeRequest *req)
 {
     NvmeNamespace *ns = req->ns;
-- 
2.31.1

Re: [PATCH-for-7.0 0/2] hw/nvme/ctrl: Buffer types cleanups

[Klaus Jensen]

[-- Attachment #1: Type: text/plain, Size: 630 bytes --]

On Nov 11 16:45, Philippe Mathieu-Daudé wrote:
> Some trivial notes I took while reviewing CVE-2021-3947:
> https://lore.kernel.org/qemu-devel/20211111153125.2258176-1-philmd@redhat.com/
> 
> Based-on: <20211111153125.2258176-1-philmd@redhat.com>
> 
> *** BLURB HERE ***
> 
> Philippe Mathieu-Daudé (2):
>   hw/nvme/ctrl: Have nvme_addr_write() take const buffer
>   hw/nvme/ctrl: Pass buffers as 'void *' types
> 
>  hw/nvme/nvme.h |  4 ++--
>  hw/nvme/ctrl.c | 12 ++++++------
>  2 files changed, 8 insertions(+), 8 deletions(-)
> 

Thanks Philippe, LGTM.

Reviewed-by: Klaus Jensen <k.jensen@samsung.com>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [PATCH-for-7.0 0/2] hw/nvme/ctrl: Buffer types cleanups

[Klaus Jensen]

[-- Attachment #1: Type: text/plain, Size: 741 bytes --]

On Nov 11 19:09, Klaus Jensen wrote:
> On Nov 11 16:45, Philippe Mathieu-Daudé wrote:
> > Some trivial notes I took while reviewing CVE-2021-3947:
> > https://lore.kernel.org/qemu-devel/20211111153125.2258176-1-philmd@redhat.com/
> > 
> > Based-on: <20211111153125.2258176-1-philmd@redhat.com>
> > 
> > *** BLURB HERE ***
> > 
> > Philippe Mathieu-Daudé (2):
> >   hw/nvme/ctrl: Have nvme_addr_write() take const buffer
> >   hw/nvme/ctrl: Pass buffers as 'void *' types
> > 
> >  hw/nvme/nvme.h |  4 ++--
> >  hw/nvme/ctrl.c | 12 ++++++------
> >  2 files changed, 8 insertions(+), 8 deletions(-)
> > 
> 
> Thanks Philippe, LGTM.
> 
> Reviewed-by: Klaus Jensen <k.jensen@samsung.com>

Applied to nvme-next. Thanks!

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]